Embodiments of the present invention generally relate to the network technology, and more specifically, relate to a method and apparatus for protecting network communication security.
In network communication, a common malicious attack is forging a legal request or command. For example, CSRF (Cross-Site Request Forgery) is an example of such malicious attack. A general practice of a CSRF attack is providing a user a message containing a link or a script. If the user clicks onto the link or triggers execution of the script, an unauthorized request will be sent to a website that has completed authentication of the user. At this point, from the perspective of the website, the request is a legal request sent by an authorized user. Therefore, the request involved in the request will be executed. In this way, the CSRF attacker may achieve an illegal objective by forging a request from the authorized user.
As an example, suppose a user is accessing a website containing its personal information. After the user passes the authentication, the website provides the user a token to be used in subsequent network session. The token, for example, may be saved in the cookie by the Web browser. At this point, the attacker may send a CSRF attack message to the user. The attack message may be a link, text, image or any other format. If the user triggers the CSRF attack message, for example, clicking onto the link or triggering execution of the script, the request for the user's personal information may be sent to the website. For example, the Web browser will create a new tab for the request. In this case, the token saved in the cookie will be sent along with the request. Due to the existence of the token, the website will mistakenly believe that the received request is a legal request by the authenticated user, thereby providing the user's personal information to the attacker.
A plurality of solutions have been proposed to handle CSRF attacks. For example, the website may require provision of additional identity authentication information upon receipt of each request, e.g., authentication code. For another example, the website may shorten the life cycle of the session cookie and/or token. It would be understood that these manners will increase user burden and cause negative user experience. Some other solutions use a particular private token for some or all user requests. For example, each uniform resource locator (URL) in the web page may be provided a corresponding token. However, the huge number of tokens will increase the overheads at the server and the client, and some tokens may be rarely or even never used. Therefore, this solution cannot work effectively in various network environments, e.g., Web 2.0.